topic Re: gp logs sync with the passive but with time difference! in General Topics

gp logs sync with the passive but with time difference!

Elmokadem — Mon, 17 Aug 2020 14:29:07 GMT

Hello,

Logs should only be placed in the active node, however i am keep monitoring the globalprotect logs for 3 days and i am sure that the active node does not change, however the logs is still appears on both nodes each with different time.

Did some one noticed this ? PAN OS 9.1.3-h1

Re: gp logs sync with the passive but with time difference!

reaper — Tue, 18 Aug 2020 07:55:18 GMT

what kind of logs are you seeing?

Re: gp logs sync with the passive but with time difference!

Elmokadem — Tue, 18 Aug 2020 09:19:21 GMT

GP logs like (eventid eq gateway-logout) or (eventid eq gateway-getconfig)

i can see user logout activity logged on both active and passive but with time difference!!

system logs shouldn't be synced between HA peers as far as i know but it happens.

Re: gp logs sync with the passive but with time difference!

reaper — Tue, 18 Aug 2020 09:25:38 GMT

User-ID information (user to IP mapping) is synced between peers however, and GP logon/logoff adds/deletes users to local user mapping

(in other words, the log isn't synced, the user mapping is updated, causing a log to be created)

Re: gp logs sync with the passive but with time difference!

Elmokadem — Tue, 18 Aug 2020 09:30:25 GMT

thanks for your reply . and is it normal to have time difference between the two databases ? like i have logout activity at certain time on active FW and mapping record with some delayed time like 1 minute in the passive FW

Re: gp logs sync with the passive but with time difference!

reaper — Tue, 18 Aug 2020 14:14:48 GMT

yes, these are synced over to the peer which is not super critical so there can be a delay

sessions data is synced realtime over HA2, User-ID is synced over HA1 on intervals